1 files changed, 4 insertions, 0 deletions
diff --git a/src/array.c b/src/array.c
index febc3a7a8..7e9c0139d 100644
--- a/src/array.c
+++ b/src/array.c
@@ -561,6 +561,10 @@ mrb_ary_splice(mrb_state *mrb, mrb_value ary, mrb_int head, mrb_int len, mrb_val
   mrb_int i, argc;
 
   ary_modify(mrb, a);
+
+  /* len check */
+  if (len < 0) mrb_raisef(mrb, E_INDEX_ERROR, "negative length (%S)", mrb_fixnum_value(len));
+
   /* range check */
   if (head < 0) {
     head += a->len;